Perimeter

3/28/2018
10:23 AM
50%
50%

Kaspersky Lab Open-Sources its Threat-Hunting Tool

'KLara' was built to speed up and automate the process of identifying malware samples.

Kaspersky Lab is now offering its homegrown threat-hunting application KLara as an open-source tool, the company said today.

KLara is a YARA rules-based malware scanner that runs multiple YARA identifier rules across multiple databases simultaneously as a way to speed up the process of malware identification. Kaspersky Lab said it created the tool as a distributed system for YARA searches that includes researchers' own malware collections as well as others. 

"Detecting cyberthreats requires tools and systems that can hunt effectively for malware – particularly when tracking advanced targeted threat campaigns through months or even years of activity," said Dan Demeter, security researcher at Kaspersky Lab and one the creators of  KLara. "We created KLara to help us hunt threats better and faster" and are now sharing it with the security community, he said.

The open source tool is available via GitHub.

 

 

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Data Privacy Careers Are Helping to Close the IT Gender Gap
Dana Simberkoff, Chief Compliance and Risk Management Officer, AvePoint, Inc,  8/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1394
PUBLISHED: 2018-08-20
Multiple IBM Rational products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138425.
CVE-2018-1517
PUBLISHED: 2018-08-20
A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String data. IBM X-Force ID: 141681.
CVE-2018-1656
PUBLISHED: 2018-08-20
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.
CVE-2015-5160
PUBLISHED: 2018-08-20
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.
CVE-2015-5243
PUBLISHED: 2018-08-20
phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.